Database/Firmware, BMC & network fabric
Junos l2cpd: LLDP packets overflow a stack buffer, root code execution or Layer 2 control-plane denial of service
Impact
LLDP traffic received on a configured interface overflows a stack buffer in l2cpd, the Layer 2 control-plane daemon. With Unified Access Policy enabled the record states arbitrary code execution with root privileges; on an LLDP-enabled interface generally it is a denial of service, and repeated triggering disrupts LLDP and other Layer 2 control protocols across the device. Juniper assigned two ids to this l2cpd LLDP overflow (CVE-2026-102049 and CVE-2026-102050) - same daemon, same protocol, same fix, so they are recorded together. LLDP is enabled almost everywhere for topology discovery, and GPU fabric automation often depends on it to map rails to nodes.
Who can reach it
An unauthenticated attacker adjacent on a segment with an LLDP-enabled interface, sending crafted LLDP frames. No authentication. The root-execution variant requires Unified Access Policy on the interface.
What to do
Upgrade Junos OS / Junos OS Evolved to a fixed release per Juniper JSA112187; the upgrade reboots the device. Disabling LLDP on interfaces facing untrusted hosts removes the trigger for those ports without a reboot, but costs the discovery data that fabric tooling may rely on - check before turning it off fleet-wide.
Also covers 1 CVE
The vendor assigned a separate id to each affected code path. They share this advisory, this score and this fix, so they are one entry here.
References
Related entries
- Junos jdhcpd: malformed DHCPv4 server response gives root code execution on the deviceCVE-2026-102052 · Juniper Junos OS / Junos OS Evolved jdhcpd (DHCPv4 local-client)High
- Junos cfmd: CFM message to a down-MEP executes code as root with enhanced CFM mode enabledCVE-2026-102055 · Juniper Junos OS cfmd on MX Series / Junos OS Evolved on PTX Series (enhanced CFM)High
- Junos OS: stack overflow in jdhcpd lets an adjacent attacker break DHCP, relay and ZTPCVE-2026-102057 · Juniper Junos OS jdhcpd (DHCP client response handling)High
- Junos phone-home daemon: rogue DHCP server injects OS commands and runs them as rootCVE-2026-102059 · Juniper Junos OS / Junos OS Evolved phcd (phone-home daemon) on EX, SRX, QFXHigh
- Junos phone-home daemon: crafted DHCP SZTP bootstrap message overflows a stack buffer, root executionCVE-2026-102061 · Juniper Junos OS / Junos OS Evolved phcd (Secure-ZTP DHCP bootstrap parsing)High
- Junos rpd: malformed BGP MCAST-VPN updates from an eBGP peer hit an assertion and crash rpdCVE-2026-102064 · Juniper Junos OS / Junos OS Evolved rpd (BGP MCAST-VPN update parsing)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.